ISO 27001 Implementation Plan: 9-Month Roadmap With Owners
9 min read ยท 2026-10-25
An ISO 27001 implementation plan is the project schedule for building an information security management system (ISMS), running it for a while, and getting it ready for a certification audit. Many organizations plan six to twelve months, depending on scope, existing controls and how much time the team can give. The plan below takes nine months and has seven phases, from scope and gap analysis through to the Stage 2 audit.
This guide stays at the planning level. It shows the order of the work, the owner of each phase, the evidence each milestone should produce and how to report progress. Always confirm the exact requirements in the current edition of the standard (ISO/IEC 27001:2022) and with your certification body or auditor, because how they apply to you depends on your scope and context.
The roadmap at a glance
Goal: Run a documented ISMS for the agreed scope, with risks treated, controls in place, an internal audit and management review completed, and the certification audit passed. Duration: 9 months
Mandate, scope and gap analysis (Weeks 1-4)
Get leadership backing, set the ISMS scope and see how far you are from the standard.
- Get a named executive sponsor and agree on why you are certifying, such as customer requirements or tender rules.
- Define the ISMS scope: which products, locations, teams and systems are in and out.
- List interested parties and their security requirements, such as customers, regulators and partners.
- Run a gap analysis against the clauses and Annex A controls, using existing policies and practices as input.
- Appoint an ISMS lead and a small working group from IT, engineering, HR, legal and operations.
Milestone: Signed scope statement, gap analysis report and project plan approved by the executive sponsor.
Policy and risk method (Weeks 5-8)
Set the rules for how security is managed and how risks are assessed.
- Write the information security policy and get top management approval.
- Define the risk assessment method: how you identify risks, rate likelihood and impact, and set acceptance criteria.
- Set measurable information security objectives linked to the business goals.
- Agree on how documents and records will be controlled, versioned and stored.
Milestone: Approved security policy, risk assessment method and security objectives.
Risk assessment and treatment (Weeks 9-14)
Find the real risks in scope and decide how each one will be treated.
- Build an asset inventory for the scope: information, systems, people, suppliers and locations.
- Run risk workshops with system owners and record each risk in a risk register.
- Choose a treatment for each risk and select the controls that will address it.
- Write the Statement of Applicability, listing each Annex A control, whether it applies and why.
- Get risk owners to approve the treatment plan and accept the remaining risks.
Milestone: Risk register, risk treatment plan and Statement of Applicability approved by the risk owners.
Implement controls (Weeks 15-26)
Put the selected controls in place and keep evidence that they work.
- Group controls into workstreams with one owner each: access, assets, suppliers, HR, physical, operations, development and incidents.
- Write the procedures that are missing, such as access reviews, incident response and supplier assessment.
- Configure technical controls, such as MFA, logging, backups and vulnerability management.
- Run security awareness training for everyone in scope and keep attendance records.
- Store evidence for each control in one place, with an owner and a review date.
Milestone: Every applicable control in place or on a dated plan, with evidence stored and linked from the Statement of Applicability.
Operate and measure (Weeks 27-32)
Run the ISMS as normal work long enough to produce records an auditor can sample.
- Run the recurring activities on schedule: access reviews, backup tests, vulnerability scans and supplier checks.
- Log and handle security incidents and nonconformities through the defined process.
- Measure progress against the security objectives and record the results.
- Hold monthly ISMS meetings to track actions and risks.
Milestone: Records of recurring controls, incidents and objective measurements available for the operating period.
Internal audit and management review (Weeks 33-35)
Check the ISMS yourself and have leadership review it before the external audit.
- Run an internal audit with an auditor who is independent of the work being audited.
- Raise nonconformities and open corrective actions with owners and due dates.
- Hold a management review covering audit results, risks, incidents, objectives and resources.
- Fix the major gaps before the certification audit.
Milestone: Internal audit report and management review minutes complete, with corrective actions tracked.
Certification audit (Weeks 36-39)
Pass the two-stage certification audit and close any findings.
- Book the certification body early and confirm the audit dates and scope.
- Prepare for Stage 1, where the auditor reviews the ISMS documentation and readiness.
- Prepare interviewees and evidence for Stage 2, where the auditor checks that controls work in practice.
- Respond to findings with corrective action plans within the deadline the auditor sets.
Milestone: Stage 2 audit completed and findings closed or accepted, leading to the certification decision.
What the standard expects you to have in place
ISO 27001 has two parts. Clauses 4 to 10 describe the management system: context and scope, leadership, planning, support, operation, performance evaluation and improvement. Annex A lists reference controls, grouped in the 2022 edition into organizational, people, physical and technological themes. You decide which Annex A controls apply based on your risk assessment, and you explain those choices in the Statement of Applicability.
In practice, auditors often look for the outputs below. Treat this as a planning checklist, not a full list, and confirm the exact documentation requirements in the standard and with your auditor.
- ISMS scope and information security policy.
- Risk assessment method, risk register and risk treatment plan.
- Statement of Applicability.
- Information security objectives and how you measure them.
- Evidence of awareness training and competence.
- Internal audit results, management review records and corrective actions.
Example: a 9-month plan for a 150-person SaaS company
Picture a B2B software company whose enterprise customers now ask for ISO 27001 in their security questionnaires. Scope covers the production platform, the engineering and support teams and the head office. Most infrastructure runs on a public cloud.
Here is how the plan maps onto the company, with an owner and milestone per stage.
- Months 1-2, scope and policy (owner: head of security as ISMS lead, CTO as sponsor): scope set to the production platform and the teams that run it, gap analysis shows strong technical controls but weak supplier and HR records. Milestone: policy and risk method approved.
- Months 3-4, risk (owner: ISMS lead with system owners): asset inventory from the cloud account and the HR system, risk workshops per product area. Milestone: Statement of Applicability approved.
- Months 4-6, controls (owners: platform lead, HR manager, procurement lead): access reviews scheduled, onboarding and offboarding checklists, supplier security reviews for critical vendors, incident runbook tested. Milestone: evidence folder complete for every applicable control.
- Months 7-8, operate and audit (owner: ISMS lead): recurring controls run on schedule, internal audit by an outside consultant, management review chaired by the CTO. Milestone: corrective actions closed.
- Month 9, certification (owner: ISMS lead): Stage 1 and Stage 2 audits, minor findings fixed. Milestone: certification decision received.
Who owns what
ISO 27001 expects top management to lead the ISMS, not just approve a budget. Name the roles at the start and record them in a short RACI so the auditor can see who is accountable.
Control owners are the people who already run the related process. Avoid making the ISMS lead own every control: it slows the work and the controls stop when that person is busy.
- Executive sponsor (CEO, CTO or COO): approves the policy, resources and risk acceptance, and chairs the management review.
- ISMS lead or information security manager: owns the plan, the risk process, the Statement of Applicability and audit readiness.
- Risk owners: business or system owners who approve treatment plans and accept remaining risk.
- Control owners: IT, engineering, HR, procurement and facilities leads who run and evidence each control.
- Internal auditor: an independent person, internal or external, who audits the ISMS.
- Project manager: tracks tasks, deadlines and evidence collection if the ISMS lead needs support.
Risks and dependencies
Most delays come from people, not technology. Control owners have day jobs, evidence gets collected at the last minute, and the certification body has no free dates when you are ready. Put each of these on the risk log of the project itself, with an owner and a fallback.
Plan the operating period with care. Auditors often want to see that recurring controls have run more than once, so start them as early as possible instead of waiting until all controls are built.
- Auditor availability: book the certification body early. Fallback: keep a second body shortlisted.
- Scope creep: new products or offices added halfway. Fallback: freeze scope and plan an extension after certification.
- Key supplier evidence: cloud or software vendors slow to share their reports. Fallback: request reports in the first phase.
- Control owner capacity: owners pulled into other projects. Fallback: sponsor agrees on protected time per workstream.
How to report progress to leadership
Leadership wants three things: are we on track for the audit date, what risks have we found, and what do you need from them. Use one slide with the seven phases as a timeline, a today marker, a status color per phase and the date of the next milestone.
Add two short lists: top risks found so far with their treatment status, and decisions needed, such as risk acceptance, budget for a tool or protected time for control owners. Keep control-by-control detail in the Statement of Applicability, not in the leadership update. Report monthly during the project and through the management review once the ISMS is running.
How to adapt the plan
A small company with a narrow scope and good existing practices can often move faster, sometimes around six months. It may merge the policy and risk phases and use an outside consultant for the internal audit.
A larger or multi-site organization usually needs longer and may phase the scope, starting with one business unit and extending later. If you already hold another management system certification, such as ISO 9001, reuse its document control, internal audit and management review processes. If you are moving from SOC 2, map existing controls to Annex A first, then fill the management system gaps. Confirm any shortcut with your auditor.
Common mistakes to avoid
- Choosing a scope that is too broad for the first certification stretches the team thin, so start with the products and teams customers ask about and extend later.
- Copying policy templates without adapting them creates documents nobody follows, so write procedures that match how your teams really work.
- Picking Annex A controls before the risk assessment makes the Statement of Applicability hard to justify, so let the risk register drive control choices.
- Collecting evidence the week before the audit leads to gaps and stress, so store evidence as each control runs and review it monthly.
- Making the ISMS lead own every control turns them into a bottleneck, so assign control owners in the teams that run each process.
- Booking the certification audit late can push certification back by weeks, so contact certification bodies during the first phase.
Frequently asked questions
How long does ISO 27001 implementation take?
Many organizations plan six to twelve months from kickoff to certification. The time depends on scope, existing controls, team capacity and auditor availability. Confirm a realistic timeline with your certification body before you commit to a date.
What are the main steps to implement ISO 27001?
Set the scope and get leadership support, write the policy and risk method, assess and treat risks, write the Statement of Applicability, implement controls, operate the ISMS, run an internal audit and management review, then go through the two-stage certification audit.
What is the difference between Stage 1 and Stage 2 audits?
Stage 1 is mainly a review of your ISMS documentation and readiness. Stage 2 checks that the ISMS and controls work in practice through interviews, evidence and sampling. Your certification body will explain how they run each stage.
Do we need to implement every Annex A control?
No. You decide which controls apply based on your risk assessment and record the reasons in the Statement of Applicability. Excluded controls need a justification that holds up in the audit, so check your reasoning with your auditor.
Can we implement ISO 27001 without a consultant?
Yes, many teams do it themselves if someone has time to lead it and learn the standard. A common middle path is to run the project in-house and use an outside expert for the gap analysis or the internal audit.